diff --git a/build/BUILD b/build/BUILD
index 3ac15d07051..76a2d9b0c79 100644
--- a/build/BUILD
+++ b/build/BUILD
@@ -42,6 +42,10 @@ DOCKERIZED_BINARIES = {
         "base": "@debian-base-{ARCH}//image",
         "target": "//cmd/kube-controller-manager:kube-controller-manager",
     },
+    "workload-controller-manager": {
+        "base": "@debian-base-{ARCH}//image",
+        "target": "//cmd/workload-controller-manager:kube-controller-manager",
+    },
     "kube-scheduler": {
         "base": "@debian-base-{ARCH}//image",
         "target": "//cmd/kube-scheduler:kube-scheduler",
diff --git a/build/common.sh b/build/common.sh
index 5bfb754671f..4143b2c413a 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -97,6 +97,7 @@ kube::build::get_docker_wrapped_binaries() {
     cloud-controller-manager,"k8s.gcr.io/debian-base-${arch}:${debian_base_version}"
     kube-apiserver,"k8s.gcr.io/debian-base-${arch}:${debian_base_version}"
     kube-controller-manager,"k8s.gcr.io/debian-base-${arch}:${debian_base_version}"
+    workload-controller-manager,"k8s.gcr.io/debian-base-${arch}:${debian_base_version}"
     kube-scheduler,"k8s.gcr.io/debian-base-${arch}:${debian_base_version}"
     kube-proxy,"k8s.gcr.io/debian-iptables-${arch}:${debian_iptables_version}"
   )
diff --git a/build/debian-hyperkube-base/Dockerfile b/build/debian-hyperkube-base/Dockerfile
index bdb982c3cfb..f6c3563f43c 100644
--- a/build/debian-hyperkube-base/Dockerfile
+++ b/build/debian-hyperkube-base/Dockerfile
@@ -25,6 +25,7 @@ RUN ln -s /hyperkube /apiserver \
  && ln -s /hyperkube /usr/local/bin/cloud-controller-manager \
  && ln -s /hyperkube /usr/local/bin/kube-apiserver \
  && ln -s /hyperkube /usr/local/bin/kube-controller-manager \
+ && ln -s /hyperkube /usr/local/bin/workload-controller-manager \
  && ln -s /hyperkube /usr/local/bin/kube-proxy \
  && ln -s /hyperkube /usr/local/bin/kube-scheduler \
  && ln -s /hyperkube /usr/local/bin/kubectl \
diff --git a/build/debs/BUILD b/build/debs/BUILD
index ef415a1d625..b7b1b5aa0ea 100644
--- a/build/debs/BUILD
+++ b/build/debs/BUILD
@@ -88,6 +88,7 @@ genrule(
     "cloud-controller-manager",
     "kube-apiserver",
     "kube-controller-manager",
+    "workload-controller-manager",
     "kube-proxy",
     "kube-scheduler",
 ]] for arch in SERVER_PLATFORMS["linux"]]
@@ -160,6 +161,14 @@ genrule(
     version_file = "//build:os_package_version",
 ) for arch in SERVER_PLATFORMS["linux"]]
 
+[k8s_deb(
+    name = "workload-controller-manager",
+    description = "CloudFabric Workload Controller Manager",
+    goarch = arch,
+    tags = ["manual"],
+    version_file = "//build:os_package_version",
+) for arch in SERVER_PLATFORMS["linux"]]
+
 [k8s_deb(
     name = "kubectl",
     description = """Kubernetes Command Line Tool
diff --git a/build/lib/release.sh b/build/lib/release.sh
index 9e0de70ffe5..7524cb7975e 100644
--- a/build/lib/release.sh
+++ b/build/lib/release.sh
@@ -449,6 +449,7 @@ function kube::release::package_kube_manifests_tarball() {
   cp "${src_dir}/kube-apiserver.manifest" "${dst_dir}"
   cp "${src_dir}/abac-authz-policy.jsonl" "${dst_dir}"
   cp "${src_dir}/kube-controller-manager.manifest" "${dst_dir}"
+  cp "${src_dir}/workload-controller-manager.manifest" "${dst_dir}"
   cp "${src_dir}/kube-addon-manager.yaml" "${dst_dir}"
   cp "${src_dir}/glbc.manifest" "${dst_dir}"
   cp "${src_dir}/etcd-empty-dir-cleanup.yaml" "${dst_dir}/"
diff --git a/cluster/gce/manifests/workload-controller-manager.manifest b/cluster/gce/manifests/workload-controller-manager.manifest
new file mode 100644
index 00000000000..05e028d2b75
--- /dev/null
+++ b/cluster/gce/manifests/workload-controller-manager.manifest
@@ -0,0 +1,106 @@
+{
+"apiVersion": "v1",
+"kind": "Pod",
+"metadata": {
+  "name":"workload-controller-manager",
+  "namespace": "kube-system",
+  "annotations": {
+    "scheduler.alpha.kubernetes.io/critical-pod": "",
+    "seccomp.security.alpha.kubernetes.io/pod": "docker/default"
+  },
+  "labels": {
+    "tier": "control-plane",
+    "component": "workload-controller-manager"
+  }
+},
+"spec":{
+"hostNetwork": true,
+"containers":[
+    {
+    "name": "workload-controller-manager",
+    "image": "{{pillar['kube_docker_registry']}}/workload-controller-manager:{{pillar['workload-controller-manager_docker_tag']}}",
+    "resources": {
+      "requests": {
+        "cpu": "{{cpurequest}}"
+      }
+    },
+    "command": [
+                 "/bin/sh",
+                 "-c",
+                 "exec /usr/local/bin/workload-controller-manager {{params}} 1>>/var/log/workload-controller-manager.log 2>&1"
+               ],
+    {{container_env}}
+    "livenessProbe": {
+      "httpGet": {
+        "host": "127.0.0.1",
+        "port": 10252,
+        "path": "/healthz"
+      },
+      "initialDelaySeconds": 15,
+      "timeoutSeconds": 15
+    },
+    "volumeMounts": [
+        {{cloud_config_mount}}
+        {{additional_cloud_config_mount}}
+        {{pv_recycler_mount}}
+        { "name": "srvkube",
+        "mountPath": "/etc/srv/kubernetes",
+        "readOnly": true},
+        {{flexvolume_hostpath_mount}}
+        { "name": "logfile",
+        "mountPath": "/var/log/workload-controller-manager.log",
+        "readOnly": false},
+        { "name": "etcssl",
+        "mountPath": "/etc/ssl",
+        "readOnly": true},
+        { "name": "usrsharecacerts",
+        "mountPath": "/usr/share/ca-certificates",
+        "readOnly": true},
+        { "name": "varssl",
+        "mountPath": "/var/ssl",
+        "readOnly": true},
+        { "name": "etcopenssl",
+        "mountPath": "/etc/openssl",
+        "readOnly": true},
+        { "name": "etcpki",
+        "mountPath": "/etc/pki",
+        "readOnly": true}
+      ]
+    }
+],
+"volumes":[
+  {{cloud_config_volume}}
+  {{additional_cloud_config_volume}}
+  {{pv_recycler_volume}}
+  { "name": "srvkube",
+    "hostPath": {
+        "path": "/etc/srv/kubernetes"}
+  },
+  {{flexvolume_hostpath}}
+  { "name": "logfile",
+    "hostPath": {
+        "path": "/var/log/workload-controller-manager.log",
+        "type": "FileOrCreate"}
+  },
+  { "name": "etcssl",
+    "hostPath": {
+        "path": "/etc/ssl"}
+  },
+  { "name": "usrsharecacerts",
+    "hostPath": {
+        "path": "/usr/share/ca-certificates"}
+  },
+  { "name": "varssl",
+    "hostPath": {
+        "path": "/var/ssl"}
+  },
+  { "name": "etcopenssl",
+    "hostPath": {
+        "path": "/etc/openssl"}
+  },
+  { "name": "etcpki",
+    "hostPath": {
+        "path": "/etc/pki"}
+  }
+]
+}}
diff --git a/hack/grab-profiles.sh b/hack/grab-profiles.sh
index b0a9bc08904..c6e22dd92ef 100755
--- a/hack/grab-profiles.sh
+++ b/hack/grab-profiles.sh
@@ -58,13 +58,15 @@ scheduler_binary=""
 scheduler_port="10251"
 controller_manager_port="10252"
 controller_manager_binary=""
+workload_controller_manager_port="10352"
+workload_controller_manager_binary=""
 requested_profiles=""
 mem_pprof_flags=""
 profile_components=""
 output_dir="."
 tunnel_port="${tunnel_port:-1234}"
 
-args=$(getopt -o s:mho:k:c -l server:,master,heapster,output:,kubelet:,scheduler,controller-manager,help,inuse-space,inuse-objects,alloc-space,alloc-objects,cpu,kubelet-binary:,master-binary:,scheduler-binary:,controller-manager-binary:,scheduler-port:,controller-manager-port: -- "$@")
+args=$(getopt -o s:mho:k:c -l server:,master,heapster,output:,kubelet:,scheduler,controller-manager,workload-controller-manager,help,inuse-space,inuse-objects,alloc-space,alloc-objects,cpu,kubelet-binary:,master-binary:,scheduler-binary:,controller-manager-binary:,workload-controller-manager-binary:,scheduler-port:,controller-manager-port:,workload-controller-manager-port: -- "$@")
 if [[ $? ]]; then
   >&2 echo "Error in getopt"
   exit 1
@@ -76,6 +78,7 @@ HEAPSTER_PPROF_PATH="/api/v1/namespaces/kube-system/services/monitoring-heapster
 KUBELET_PPROF_PATH_PREFIX="/api/v1/proxy/nodes"
 SCHEDULER_PPROF_PATH_PREFIX="/api/v1/namespaces/kube-system/pods/kube-scheduler/proxy"
 CONTROLLER_MANAGER_PPROF_PATH_PREFIX="/api/v1/namespaces/kube-system/pods/kube-controller-manager/proxy"
+WORKLOAD_CONTROLLER_MANAGER_PPROF_PATH_PREFIX="/api/v1/namespaces/kube-system/pods/workload-controller-manager/proxy"
 
 eval set -- "${args}"
 
@@ -170,6 +173,28 @@ while true; do
       controller_manager_port=$1
       shift
       ;;
+    -c|--workload-controller-manager)
+      shift
+      profile_components="workload-controller-manager ${profile_components}"
+      ;;
+    --workload-controller-manager-binary)
+      shift
+      if [ -z "$1" ]; then
+        >&2 echo "empty argument to --workload-controller-manager-binary flag"
+        exit 1
+      fi
+      workload_controller_manager_binary=$1
+      shift
+      ;;
+    --workload-controller-manager-port)
+      shift
+      if [ -z "$1" ]; then
+        >&2 echo "empty argument to --workload-controller-manager-port flag"
+        exit 1
+      fi
+      workload_controller_manager_port=$1
+      shift
+      ;;
     -o|--output)
       shift
       if [ -z "$1" ]; then
@@ -268,6 +293,10 @@ for component in ${profile_components}; do
       path="${CONTROLLER_MANAGER_PPROF_PATH_PREFIX}-${server_addr}:${controller_manager_port}"
       binary=${controller_manager_binary}
       ;;
+    workload-controller-manager)
+      path="${WORKLOAD_CONTROLLER_MANAGER_PPROF_PATH_PREFIX}-${server_addr}:${workload_controller_manager_port}"
+      binary=${workload_controller_manager_binary}
+      ;;
     scheduler)
       path="${SCHEDULER_PPROF_PATH_PREFIX}-${server_addr}:${scheduler_port}"
       binary=${scheduler_binary}
diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index e9c3b066925..f31d6ad9775 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -72,6 +72,7 @@ kube::golang::server_targets() {
     cmd/kube-apiserver
     cmd/kube-controller-manager
     cmd/cloud-controller-manager
+    cmd/workload-controller-manager
     cmd/kubelet
     cmd/kubeadm
     cmd/hyperkube
@@ -93,6 +94,7 @@ kube::golang::server_image_targets() {
     cmd/cloud-controller-manager
     cmd/kube-apiserver
     cmd/kube-controller-manager
+    cmd/workload-controller-manager
     cmd/kube-scheduler
     cmd/kube-proxy
   )
@@ -321,6 +323,7 @@ readonly KUBE_STATIC_LIBRARIES=(
   cloud-controller-manager
   kube-apiserver
   kube-controller-manager
+  workload-controller-manager
   kube-scheduler
   kube-proxy
   kubeadm
@@ -331,6 +334,7 @@ readonly KUBE_STATIC_LIBRARIES=(
 readonly KUBE_COVERAGE_INSTRUMENTED_PACKAGES=(
   k8s.io/kubernetes/cmd/kube-apiserver
   k8s.io/kubernetes/cmd/kube-controller-manager
+  k8s.io/kubernetes/cmd/workload-controller-manager
   k8s.io/kubernetes/cmd/kube-scheduler
   k8s.io/kubernetes/cmd/kube-proxy
   k8s.io/kubernetes/cmd/kubelet
diff --git a/hack/lib/util.sh b/hack/lib/util.sh
index 7ea579e41bb..b5722c6f7ca 100755
--- a/hack/lib/util.sh
+++ b/hack/lib/util.sh
@@ -220,6 +220,7 @@ kube::util::gen-docs() {
   "${genkubedocs}" "${dest}/docs/admin/" "kube-apiserver"
   "${genkubedocs}" "${dest}/docs/admin/" "kube-controller-manager"
   "${genkubedocs}" "${dest}/docs/admin/" "cloud-controller-manager"
+  "${genkubedocs}" "${dest}/docs/admin/" "workload-controller-manager"
   "${genkubedocs}" "${dest}/docs/admin/" "kube-proxy"
   "${genkubedocs}" "${dest}/docs/admin/" "kube-scheduler"
   "${genkubedocs}" "${dest}/docs/admin/" "kubelet"
@@ -229,6 +230,7 @@ kube::util::gen-docs() {
   "${genman}" "${dest}/docs/man/man1/" "kube-apiserver"
   "${genman}" "${dest}/docs/man/man1/" "kube-controller-manager"
   "${genman}" "${dest}/docs/man/man1/" "cloud-controller-manager"
+  "${genman}" "${dest}/docs/man/man1/" "workload-controller-manager"
   "${genman}" "${dest}/docs/man/man1/" "kube-proxy"
   "${genman}" "${dest}/docs/man/man1/" "kube-scheduler"
   "${genman}" "${dest}/docs/man/man1/" "kubelet"
diff --git a/test/cmd/legacy-script.sh b/test/cmd/legacy-script.sh
index e84142069ab..690459abd49 100755
--- a/test/cmd/legacy-script.sh
+++ b/test/cmd/legacy-script.sh
@@ -64,6 +64,7 @@ SECURE_API_PORT=${SECURE_API_PORT:-6443}
 API_HOST=${API_HOST:-127.0.0.1}
 KUBELET_HEALTHZ_PORT=${KUBELET_HEALTHZ_PORT:-10248}
 CTLRMGR_PORT=${CTLRMGR_PORT:-10252}
+WORKLOAD_CTLRMGR_PORT=${WORKLOAD_CTLRMGR_PORT:-10352}
 PROXY_HOST=127.0.0.1 # kubectl only serves on localhost.
 
 IMAGE_NGINX="k8s.gcr.io/nginx:1.7.9"